CSLA .NET is a framework designed for the development of reusable, object-oriented business layers for applications. Versions 5.5.4 and below allow the use of WcfProxy. WcfProxy uses the now-obsolete NetDataContractSerializer (NDCS) and is vulnerable to remote code execution during deserialization. This vulnerability is fixed in version 6.0.0. To workaround this issue, remove the WcfProxy in data portal configurations.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Marimer |
|
No data.
No data.
References
History
Tue, 09 Dec 2025 10:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Marimer
Marimer csla |
|
| Vendors & Products |
Marimer
Marimer csla |
Tue, 09 Dec 2025 03:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | CSLA .NET is a framework designed for the development of reusable, object-oriented business layers for applications. Versions 5.5.4 and below allow the use of WcfProxy. WcfProxy uses the now-obsolete NetDataContractSerializer (NDCS) and is vulnerable to remote code execution during deserialization. This vulnerability is fixed in version 6.0.0. To workaround this issue, remove the WcfProxy in data portal configurations. | |
| Title | CSLA .NET is vulnerable to Remote Code Execution via WcfProxy | |
| Weaknesses | CWE-502 | |
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published: 2025-12-09T03:18:37.698Z
Updated: 2025-12-09T03:18:37.698Z
Reserved: 2025-12-05T15:42:44.716Z
Link: CVE-2025-66631
Vulnrichment
No data.
NVD
No data.
Redhat
No data.